Ubisoft hacked, account data compromised
support.ubi.com
Ubisoft hacked, account data compromised
1–10 of 104 posts
Re: Ubisoft hacked, account data compromised
#2I just got an email about this from Ubisoft, with a link to change my password. Yet another incident to prove that unique passwords and utilities such as RoboForm / Dashlane / Lastpass are a necessity.
Re: Ubisoft hacked, account data compromised
#3Yay!
Re: Ubisoft hacked, account data compromised
#4I wouldn't care so much about this, except that I am often essentially required to give my data to Ubisoft (and other third party publishers) in order to buy/play their games. EA, you're no better.
Why are all these companies adamant about trying to bootstrap their own services. It's maddening, and it only causes things like this to happen. Steam exists, and it's amazing. Stop trying to do better -- you won't.
Re: Ubisoft hacked, account data compromised
#5I just got an email about this from Ubisoft, with a link to change my password. Yet another incident to prove that unique passwords and utilities such as RoboForm / Dashlane / Lastpass are a necessity.
As an alternative, you could GPG a text file with all passwords and use...
hexdump -n 16 -v -e '/1 "%02X"' /dev/urandom
Re: Ubisoft hacked, account data compromised
#6I wouldn't care so much about this, except that I am often essentially required to give my data to Ubisoft (and other third party publishers) in order to buy/play their games. EA, you're no better. Why are all these companies adamant about trying to bootstrap their own services. It's maddening, and it only causes things like this to happen. Steam exists, and it's amazing. Stop trying to do better -- you won't.
Everything else being equal, Steam may well end up being similarly hacked in the future. The big difference with them is that they use 2FA, so even if your hashed password were stolen and cracked, they still would not be able to access your account.
Edit: I just went through Ubi's password change process, they also restrict password lengths to 8 to 16 characters. Annoys the heck out of me when companies do this.
Re: Ubisoft hacked, account data compromised
#7Let's play the guessing game: by "encrypted" they mean MD5'd?
Re: Ubisoft hacked, account data compromised
#8I wouldn't care so much about this, except that I am often essentially required to give my data to Ubisoft (and other third party publishers) in order to buy/play their games. EA, you're no better. Why are all these companies adamant about trying to bootstrap their own services. It's maddening, and it only causes things like this to happen. Steam exists, and it's amazing. Stop trying to do better -- you won't.
Relying on one service is good for no one. Specially consumers.
Re: Ubisoft hacked, account data compromised
#9I wouldn't care so much about this, except that I am often essentially required to give my data to Ubisoft (and other third party publishers) in order to buy/play their games. EA, you're no better. Why are all these companies adamant about trying to bootstrap their own services. It's maddening, and it only causes things like this to happen. Steam exists, and it's amazing. Stop trying to do better -- you won't.
I have mixed feelings about that. On the one hand, I fully agree - I hate having all kinds of junky game clients running on my computer when I ought to just be able to have one, Steam, which is obviously doing a decent job.
On the other hand, I think that competition will drive Steam to be better (or maybe, just maybe, result in something better than Steam), and so I don't necessarily want the other companies to stop trying to compete entirely, either.
Re: Ubisoft hacked, account data compromised
#10To add insult to injury, another (though less severe of course) security issue is this - I went to the "change password" page per their recommendation, and typed my email. Usually, security best practices say that you should not volunteer any information for a potential attacker, e.g. don't tell the user if an email was sent or not, as this can be used for example to eventually construct a list of all their user's emails (Although they have captcha protection so it's not really feasibly or at least less likely in a reasonable cost, but still, I can find out if John Doe has a Ubisoft account or not, e.g. if I'm Joe's manager who works for a competitor, and he swore last night that he never plays Ubisoft games, busted!).
So this is what I got from their change password screen:
"No account was found matching those entries. No email will be sent."
So I'm glad I learned that I don't have my password compromised. but I think someone at Ubisoft need to take web security 101 again
p.s. Who encrypts passwords anyway? isn't there a consensus to hash using bcrypt / scrypt + random salt?